Changes the assertions to only care that an error has occurred, and
not that the error is a bad certificate error from the tls handshake.
When the tests fail the error is a bad pipe error which seems to
be caused by the handshake failing prior to the grpc settings being
written. In either scenario the connection is terminated due to
incorrect certificates so asserting that an error was received should
be satisfactory.
* Edit the labels topic
* Update labels section and related includes, add a new variable
* Add missing word
* Fix spelling
* Fix spelling
* Fix issues, remove off-topic section
* Modify the partial a little more
* Fix typo
* Remove the scopedblock from tctl.mdx, fix some typos and terminology.
* Lint typos
* fix path to Local users
* change description for static labels, add complex string example
* Clarify string example
* Clarify string example
* Change h4 to bold text to appease the linter
* Get accessInfo based on user on access request drop
That's how it used to be before user login state was introduced. When
dropping a resource access request, we want to restore certs back to the
state before the access request was assumed, so that the user access is
not limited only to select resources. In the past, this was done by
calculating accessInfo from a plan user object.
This approach had the side effect of refreshing the role list of the user
based on the current backend state without the need to provide credentials
again. Teleport Connect used this side effect to make the setup of Connect
My Computer interaction-free.
Theoretically, it'd be beneficial for `tsh request drop` to use login state
rather than the current backend state, as it'd make it impossible to "escalate"
privileges by refreshing the list of roles without authenticating again.
However, this brakes the setup of Connect My Computer as it expects
GenerateUserCerts to return a role list based on a current user role list.
This commit reverts that change. An alternative would be to change Connect
My Computer setup to require a one-time relogin midway through.
* Use regular login flow in CreateConnectMyComputerRole integration test
* Fix typo
* Increase wait time when switching from setup to status
It was a little bit too short. Preferably, there should be an additional
success animation of some kind at the end, but we're going to leave this
out for now.
* Adjust copy of the downloading state
"Verifying" sounds like we're doing some actual verification with shasum
or something, but we're basically just checking the version of the
binary.
* Make the connect/disconnect button larger
It has 100% width, but it was a little bit too short for such a wide
button.
* Status doc: Add unmountOnExit to Transition
This way the child component will get unmounted on the exit state.
Otherwise we'd attempt to render it even if there was no agent node.
* Change text casing in nav menu of Connect My Computer
We recently started to apply title case to all labels, we'll probably
have to start doing to for buttons as well.
* Skeleton of hot-swappable tls credentials for api client
* Start work on SSH support
* Add note to what needs doing
* Support rotating ssh host cert
* Tidy u implementation
* Further tidy dynamic credential implementation
* Add godoc to new function
* Move code into credentials.go
* Add some more explanatory docs
* Fix panics intrdouced by refactor
* Add tests & make fix-imports
* Add helper for extracting principal
* build: Build webassets for CentOS 7 with Ubuntu buildbox
Build the webassets for the CentOS 7 binaries using the standard Ubuntu
buildbox prior to building the binaries. This allows us to use a later
version of node.js to build the UI than what is available on CentOS 7.
The `release-unix` and `clean` targets need to be rejigged a little as
`release-unix` first cleans any pre-build webassets. So we add a new
target `release-unix-preserving-webassets` that only cleans the build
and not the webassets and update the Makefile in `build.assets` to call
this new target when building CentOS 7 binaries.
* build: Conditionally build enterprise webassets
Only build enterprise webassets if the enterprise submodule is present.
For a normal release, this will always be the case, but for local
testing and people wishing to build just the OSS release, the enterprise
submodule may not be present.
* build: Build webassets with buildbox-connect
Use the Teleport Connect buildbox for building the webassets. That
ensures the same version of node is used for building all the node
stuff; the web UI as well as Teleport Connect. It makes maintenance of
the buildboxes easier as we can move to using only the one buildbox for
node in the future.
* build: Pre-build webassets for non-centos7 build targets
Add a dependency on `webassets` for the non-centos7 fips build/release
targets in build.assets/Makefile. These targets were recently changed to
actually use centos7 anyway, so we do need to pre-build webassets as
centos7 will soon no longer be able to build them.
NOTE: These updated targets should probably be removed. They are
effectively duplicates of their centos7 counterparts now and should
probably just chain to those targets. The `release-fips` target is
actually broken at the moment as it needs to use `scl enable ...` to
build now it uses centos7.
* Replace "standard Ubuntu buildbox" in comments with buildbox-connect
---------
Co-authored-by: Grzegorz Zdunek <[email protected]>
Co-authored-by: Grzegorz Zdunek <[email protected]>
* Make SSH node listener to use multiplexer to leverage parsing of signed PROXY headers
Before for backward compatibility reason we used regular listener and later
we wrapped connection into handler that could parse signed PROXY header or
proxyHelloSignature for getting correct user IP. But
after removal of proxyHelloSignature we don't need the wrapper anymore.
* Improve error message
Co-authored-by: rosstimothy <[email protected]>
---------
Co-authored-by: rosstimothy <[email protected]>
In #30277 we made the discovery process make two DNS queries
in parallel. There was an error in this logic - since we don't
write to the channel on error, if both queries fail we end up
waiting a full 5 seconds even if the failures occur much quicker
than that.
* Additional safety with `X-Forwarded-Host` handling
This adds `utils.GetSingleHeader` as a common way to make sure that additional headers are not being inserted into the request.
We use this in the `aws`, `azure`, and `gcp` handler as part of verifying the source of the request.
In addition `alpnproxy/local_proxy.go` contains a fix where an invalid `Host` header can allow an arbitrary `X-Forwarded-Host` value to pass through unchanged.
* Apply PR feedback around error type and testing
* Update retry policies and secure client session cache
Improved gRPC client connection reliability with retry policies and enhanced security by enabling session ticket caching for TLS connections. The retry policies are added in client.go file specifying the maxAttempts, backoff details, and retryable status codes. This will enhance the client connection reliability during temporary network issues. In helpers.go, the session tickets caching for the TLS connections is added which will help in reusing the session parameters, thereby enhancing the connection security.
* Increase max attempts and backoff for gRPC calls
Changed the "maxAttempts" from 5 to 15 and the "maxBackoff" from 7s to 17s in the retry policy to allow more retry attempts and longer intervals between attempts. Added the "go-grpc-middleware/retry" package for retrying failed requests, which adds resilience against transient failures in downstream services. Also, adjusted the order of retry options to prevent them from being overwritten by default ones.
* Remove retry packages and configurations from gRPC setup
This commit removes the dependency and configurations for gRPC retry middleware. Tests and application behavior have shown that the built-in gRPC retry logic is sufficient for our use cases. The removed package was causing unnecessary overhead and complexity in the code.
* Replace unnecessary assert with require in tests
The commit switches from using the 'assert' package to 'require' in our tests. The 'require' package will stop the test immediately after the assertion fails which makes test failures easier to understand and debug. These changes improve the clarity and maintainability of our tests.
* Move gRPC error intercetpors to api/utils/grpc/interceptors.
* Use error interceptors in api client and mock server.
* Apply suggestions from CR.
* Unwrap FromGRPC errors in middleware.
* Use gRPC auth service in tests instead of external example service.
* It's gRPC!!!
* Fix unit test.
* Add error interceptor to proxy client.
* Fix merge conflict.
* Use the most recent user object for the bot generation label.
The bot generation label now uses the current user object instead of the
existing user state label.
* validateGenerationLabel uses username instead of passing in the user state.
This change updates SSH server heartbeats to fetch metadata in the
background so that the first heartbeat won't be delayed (this was
causing flakiness in tests).
This test starts a session and then immediately tries to join it.
Sometimes we're too fast, and the session tracker doesn't yet exist
so the join fails.
Fix by waiting for the session tracker to show up before attempting
the join.
Closes#13607
Przemko Robakowski